Analysis Overview
SHA256
4f405bcd108372b8b42a0a27e6938da98febc87a9463fa51ebed286b69f19b60
Threat Level: Known bad
The file 4f405bcd108372b8b42a0a27e6938da98febc87a9463fa51ebed286b69f19b60 was found to be: Known bad.
Malicious Activity Summary
Mystic
Amadey
Modifies Windows Defender Real-time Protection settings
RedLine
Detects Healer an antivirus disabler dropper
Detect Mystic stealer payload
Healer
Loads dropped DLL
Checks computer location settings
Executes dropped EXE
Windows security modification
Adds Run key to start application
Suspicious use of SetThreadContext
Unsigned PE
Enumerates physical storage devices
Program crash
Suspicious use of AdjustPrivilegeToken
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 20:42
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 20:42
Reported
2023-10-10 21:10
Platform
win7-20230831-en
Max time kernel
121s
Max time network
126s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe | N/A |
Mystic
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0795403.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1526405.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6250411.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7787959.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9567824.exe | N/A |
Loads dropped DLL
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\4f405bcd108372b8b42a0a27e6938da98febc87a9463fa51ebed286b69f19b60.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0795403.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1526405.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6250411.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7787959.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2604 set thread context of 2536 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9567824.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9567824.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\4f405bcd108372b8b42a0a27e6938da98febc87a9463fa51ebed286b69f19b60.exe
"C:\Users\Admin\AppData\Local\Temp\4f405bcd108372b8b42a0a27e6938da98febc87a9463fa51ebed286b69f19b60.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0795403.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0795403.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1526405.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1526405.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6250411.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6250411.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7787959.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7787959.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9567824.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9567824.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 276
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 268
Network
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0795403.exe
| MD5 | cff9a270db09630b0e5a52c5a0be5f0c |
| SHA1 | f8da47f571658c211b413a88a174c2aa6c80dd15 |
| SHA256 | 38152b91b9471da19559c0ff6819b0f1021aa47796a687d278b412902ef77301 |
| SHA512 | 8bf7bacbec5bc230d20abf961b9ae37c6d4c7a648a524ee8de65be98bd306cf9e539734601aebfcbafe26fcdff8804585184b739f2e6a494ed53016e4c922087 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0795403.exe
| MD5 | cff9a270db09630b0e5a52c5a0be5f0c |
| SHA1 | f8da47f571658c211b413a88a174c2aa6c80dd15 |
| SHA256 | 38152b91b9471da19559c0ff6819b0f1021aa47796a687d278b412902ef77301 |
| SHA512 | 8bf7bacbec5bc230d20abf961b9ae37c6d4c7a648a524ee8de65be98bd306cf9e539734601aebfcbafe26fcdff8804585184b739f2e6a494ed53016e4c922087 |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0795403.exe
| MD5 | cff9a270db09630b0e5a52c5a0be5f0c |
| SHA1 | f8da47f571658c211b413a88a174c2aa6c80dd15 |
| SHA256 | 38152b91b9471da19559c0ff6819b0f1021aa47796a687d278b412902ef77301 |
| SHA512 | 8bf7bacbec5bc230d20abf961b9ae37c6d4c7a648a524ee8de65be98bd306cf9e539734601aebfcbafe26fcdff8804585184b739f2e6a494ed53016e4c922087 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0795403.exe
| MD5 | cff9a270db09630b0e5a52c5a0be5f0c |
| SHA1 | f8da47f571658c211b413a88a174c2aa6c80dd15 |
| SHA256 | 38152b91b9471da19559c0ff6819b0f1021aa47796a687d278b412902ef77301 |
| SHA512 | 8bf7bacbec5bc230d20abf961b9ae37c6d4c7a648a524ee8de65be98bd306cf9e539734601aebfcbafe26fcdff8804585184b739f2e6a494ed53016e4c922087 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1526405.exe
| MD5 | 8a6d8092804e13580d5b1230be6ea429 |
| SHA1 | bbddbc17f85f6da94867af292118cb9345523360 |
| SHA256 | 48b995bc819cb201e80c18614bb9f3f50746b581000d98b7cbe15f5ca1f63ddc |
| SHA512 | f6335cb298126a5c740847ad8b658efb44356fe9344dc01c2b3e431b043a5f5529ac51ae47647001c5f8de95ec59d48fbb8d963d710d03f726936ed865072494 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1526405.exe
| MD5 | 8a6d8092804e13580d5b1230be6ea429 |
| SHA1 | bbddbc17f85f6da94867af292118cb9345523360 |
| SHA256 | 48b995bc819cb201e80c18614bb9f3f50746b581000d98b7cbe15f5ca1f63ddc |
| SHA512 | f6335cb298126a5c740847ad8b658efb44356fe9344dc01c2b3e431b043a5f5529ac51ae47647001c5f8de95ec59d48fbb8d963d710d03f726936ed865072494 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1526405.exe
| MD5 | 8a6d8092804e13580d5b1230be6ea429 |
| SHA1 | bbddbc17f85f6da94867af292118cb9345523360 |
| SHA256 | 48b995bc819cb201e80c18614bb9f3f50746b581000d98b7cbe15f5ca1f63ddc |
| SHA512 | f6335cb298126a5c740847ad8b658efb44356fe9344dc01c2b3e431b043a5f5529ac51ae47647001c5f8de95ec59d48fbb8d963d710d03f726936ed865072494 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1526405.exe
| MD5 | 8a6d8092804e13580d5b1230be6ea429 |
| SHA1 | bbddbc17f85f6da94867af292118cb9345523360 |
| SHA256 | 48b995bc819cb201e80c18614bb9f3f50746b581000d98b7cbe15f5ca1f63ddc |
| SHA512 | f6335cb298126a5c740847ad8b658efb44356fe9344dc01c2b3e431b043a5f5529ac51ae47647001c5f8de95ec59d48fbb8d963d710d03f726936ed865072494 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6250411.exe
| MD5 | 19e7c77172efa1f049c8737febf5392c |
| SHA1 | 22214e462f09f51d7d510fa3ad99f7c685584fb3 |
| SHA256 | e2be01d99b0a6b9530ee2d93d1ac3e6f9702a68789fa3bf56ea84969ae22fc56 |
| SHA512 | 0b03e4d7f0baa25aba75b5c8fd3395c4977e2a45d88ce09b7eb3f2126761e1933d982a42fe621a8fa9a3fea16eba6ff3daa73bd692265c24cde4ee92a00252c0 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6250411.exe
| MD5 | 19e7c77172efa1f049c8737febf5392c |
| SHA1 | 22214e462f09f51d7d510fa3ad99f7c685584fb3 |
| SHA256 | e2be01d99b0a6b9530ee2d93d1ac3e6f9702a68789fa3bf56ea84969ae22fc56 |
| SHA512 | 0b03e4d7f0baa25aba75b5c8fd3395c4977e2a45d88ce09b7eb3f2126761e1933d982a42fe621a8fa9a3fea16eba6ff3daa73bd692265c24cde4ee92a00252c0 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6250411.exe
| MD5 | 19e7c77172efa1f049c8737febf5392c |
| SHA1 | 22214e462f09f51d7d510fa3ad99f7c685584fb3 |
| SHA256 | e2be01d99b0a6b9530ee2d93d1ac3e6f9702a68789fa3bf56ea84969ae22fc56 |
| SHA512 | 0b03e4d7f0baa25aba75b5c8fd3395c4977e2a45d88ce09b7eb3f2126761e1933d982a42fe621a8fa9a3fea16eba6ff3daa73bd692265c24cde4ee92a00252c0 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6250411.exe
| MD5 | 19e7c77172efa1f049c8737febf5392c |
| SHA1 | 22214e462f09f51d7d510fa3ad99f7c685584fb3 |
| SHA256 | e2be01d99b0a6b9530ee2d93d1ac3e6f9702a68789fa3bf56ea84969ae22fc56 |
| SHA512 | 0b03e4d7f0baa25aba75b5c8fd3395c4977e2a45d88ce09b7eb3f2126761e1933d982a42fe621a8fa9a3fea16eba6ff3daa73bd692265c24cde4ee92a00252c0 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7787959.exe
| MD5 | ecd67f71e7ab8f63436691739e604baf |
| SHA1 | 6b65563fee1afa40fbbd131db7af7521b54fd5f7 |
| SHA256 | cff0f13d0622f24b9a6d2d80ef7f2b8f0237318aeb8d8fa24b4c2af938a52f4f |
| SHA512 | b0a404a1d02ddfa8b645325858000f4dbd4ccb5f13692b5402fab3fd06a73226da324dbda3c56d363b3b564cafdf9a7459565f7e2ad96b29300bcb73d72feff2 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7787959.exe
| MD5 | ecd67f71e7ab8f63436691739e604baf |
| SHA1 | 6b65563fee1afa40fbbd131db7af7521b54fd5f7 |
| SHA256 | cff0f13d0622f24b9a6d2d80ef7f2b8f0237318aeb8d8fa24b4c2af938a52f4f |
| SHA512 | b0a404a1d02ddfa8b645325858000f4dbd4ccb5f13692b5402fab3fd06a73226da324dbda3c56d363b3b564cafdf9a7459565f7e2ad96b29300bcb73d72feff2 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7787959.exe
| MD5 | ecd67f71e7ab8f63436691739e604baf |
| SHA1 | 6b65563fee1afa40fbbd131db7af7521b54fd5f7 |
| SHA256 | cff0f13d0622f24b9a6d2d80ef7f2b8f0237318aeb8d8fa24b4c2af938a52f4f |
| SHA512 | b0a404a1d02ddfa8b645325858000f4dbd4ccb5f13692b5402fab3fd06a73226da324dbda3c56d363b3b564cafdf9a7459565f7e2ad96b29300bcb73d72feff2 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7787959.exe
| MD5 | ecd67f71e7ab8f63436691739e604baf |
| SHA1 | 6b65563fee1afa40fbbd131db7af7521b54fd5f7 |
| SHA256 | cff0f13d0622f24b9a6d2d80ef7f2b8f0237318aeb8d8fa24b4c2af938a52f4f |
| SHA512 | b0a404a1d02ddfa8b645325858000f4dbd4ccb5f13692b5402fab3fd06a73226da324dbda3c56d363b3b564cafdf9a7459565f7e2ad96b29300bcb73d72feff2 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe
| MD5 | 54422ab3024d4dc2244c37bdd95e66ea |
| SHA1 | f232f6fb96ab795cc98522907f4e29740b36dfa8 |
| SHA256 | c15cfbe7dee5c92962ac951217efc072f7dd5b80dd547cf764ce169a61497095 |
| SHA512 | 5c9ba83cbe8150c077af83b6bbb8d4a5cdff988fd4915be872be968aefb453c2bdfb97cf681903e2ee8c373bd969eb054f8374d0cf60387c1aa44fd791c54f5d |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe
| MD5 | 54422ab3024d4dc2244c37bdd95e66ea |
| SHA1 | f232f6fb96ab795cc98522907f4e29740b36dfa8 |
| SHA256 | c15cfbe7dee5c92962ac951217efc072f7dd5b80dd547cf764ce169a61497095 |
| SHA512 | 5c9ba83cbe8150c077af83b6bbb8d4a5cdff988fd4915be872be968aefb453c2bdfb97cf681903e2ee8c373bd969eb054f8374d0cf60387c1aa44fd791c54f5d |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe
| MD5 | 54422ab3024d4dc2244c37bdd95e66ea |
| SHA1 | f232f6fb96ab795cc98522907f4e29740b36dfa8 |
| SHA256 | c15cfbe7dee5c92962ac951217efc072f7dd5b80dd547cf764ce169a61497095 |
| SHA512 | 5c9ba83cbe8150c077af83b6bbb8d4a5cdff988fd4915be872be968aefb453c2bdfb97cf681903e2ee8c373bd969eb054f8374d0cf60387c1aa44fd791c54f5d |
memory/2612-48-0x0000000000190000-0x000000000019A000-memory.dmp
memory/2612-49-0x000007FEF5450000-0x000007FEF5E3C000-memory.dmp
memory/2612-50-0x000007FEF5450000-0x000007FEF5E3C000-memory.dmp
memory/2612-51-0x000007FEF5450000-0x000007FEF5E3C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9567824.exe
| MD5 | 6fceb82ce3dad9da64cd2ff4d4242a1d |
| SHA1 | bbfcf44036193c98e02ac09a0e6f185ae1e510cc |
| SHA256 | a71ac40c8509a787da333f02a9607ba7bd4c62dbf16769df4bd6eefd4b01b469 |
| SHA512 | ccd8c2650b32eb3c76ef90d43bbaadb4d73776130ac94cd7a6a5f6fc5e43fbab46c9c0fe4e937dbfb5c13b5b08631cd3abeddabe17ba3d899413b8e96c7b6ef1 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9567824.exe
| MD5 | 6fceb82ce3dad9da64cd2ff4d4242a1d |
| SHA1 | bbfcf44036193c98e02ac09a0e6f185ae1e510cc |
| SHA256 | a71ac40c8509a787da333f02a9607ba7bd4c62dbf16769df4bd6eefd4b01b469 |
| SHA512 | ccd8c2650b32eb3c76ef90d43bbaadb4d73776130ac94cd7a6a5f6fc5e43fbab46c9c0fe4e937dbfb5c13b5b08631cd3abeddabe17ba3d899413b8e96c7b6ef1 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9567824.exe
| MD5 | 6fceb82ce3dad9da64cd2ff4d4242a1d |
| SHA1 | bbfcf44036193c98e02ac09a0e6f185ae1e510cc |
| SHA256 | a71ac40c8509a787da333f02a9607ba7bd4c62dbf16769df4bd6eefd4b01b469 |
| SHA512 | ccd8c2650b32eb3c76ef90d43bbaadb4d73776130ac94cd7a6a5f6fc5e43fbab46c9c0fe4e937dbfb5c13b5b08631cd3abeddabe17ba3d899413b8e96c7b6ef1 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9567824.exe
| MD5 | 6fceb82ce3dad9da64cd2ff4d4242a1d |
| SHA1 | bbfcf44036193c98e02ac09a0e6f185ae1e510cc |
| SHA256 | a71ac40c8509a787da333f02a9607ba7bd4c62dbf16769df4bd6eefd4b01b469 |
| SHA512 | ccd8c2650b32eb3c76ef90d43bbaadb4d73776130ac94cd7a6a5f6fc5e43fbab46c9c0fe4e937dbfb5c13b5b08631cd3abeddabe17ba3d899413b8e96c7b6ef1 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9567824.exe
| MD5 | 6fceb82ce3dad9da64cd2ff4d4242a1d |
| SHA1 | bbfcf44036193c98e02ac09a0e6f185ae1e510cc |
| SHA256 | a71ac40c8509a787da333f02a9607ba7bd4c62dbf16769df4bd6eefd4b01b469 |
| SHA512 | ccd8c2650b32eb3c76ef90d43bbaadb4d73776130ac94cd7a6a5f6fc5e43fbab46c9c0fe4e937dbfb5c13b5b08631cd3abeddabe17ba3d899413b8e96c7b6ef1 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9567824.exe
| MD5 | 6fceb82ce3dad9da64cd2ff4d4242a1d |
| SHA1 | bbfcf44036193c98e02ac09a0e6f185ae1e510cc |
| SHA256 | a71ac40c8509a787da333f02a9607ba7bd4c62dbf16769df4bd6eefd4b01b469 |
| SHA512 | ccd8c2650b32eb3c76ef90d43bbaadb4d73776130ac94cd7a6a5f6fc5e43fbab46c9c0fe4e937dbfb5c13b5b08631cd3abeddabe17ba3d899413b8e96c7b6ef1 |
memory/2536-61-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2536-62-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2536-63-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2536-64-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2536-65-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2536-66-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2536-67-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2536-68-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2536-70-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2536-72-0x0000000000400000-0x0000000000428000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9567824.exe
| MD5 | 6fceb82ce3dad9da64cd2ff4d4242a1d |
| SHA1 | bbfcf44036193c98e02ac09a0e6f185ae1e510cc |
| SHA256 | a71ac40c8509a787da333f02a9607ba7bd4c62dbf16769df4bd6eefd4b01b469 |
| SHA512 | ccd8c2650b32eb3c76ef90d43bbaadb4d73776130ac94cd7a6a5f6fc5e43fbab46c9c0fe4e937dbfb5c13b5b08631cd3abeddabe17ba3d899413b8e96c7b6ef1 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9567824.exe
| MD5 | 6fceb82ce3dad9da64cd2ff4d4242a1d |
| SHA1 | bbfcf44036193c98e02ac09a0e6f185ae1e510cc |
| SHA256 | a71ac40c8509a787da333f02a9607ba7bd4c62dbf16769df4bd6eefd4b01b469 |
| SHA512 | ccd8c2650b32eb3c76ef90d43bbaadb4d73776130ac94cd7a6a5f6fc5e43fbab46c9c0fe4e937dbfb5c13b5b08631cd3abeddabe17ba3d899413b8e96c7b6ef1 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9567824.exe
| MD5 | 6fceb82ce3dad9da64cd2ff4d4242a1d |
| SHA1 | bbfcf44036193c98e02ac09a0e6f185ae1e510cc |
| SHA256 | a71ac40c8509a787da333f02a9607ba7bd4c62dbf16769df4bd6eefd4b01b469 |
| SHA512 | ccd8c2650b32eb3c76ef90d43bbaadb4d73776130ac94cd7a6a5f6fc5e43fbab46c9c0fe4e937dbfb5c13b5b08631cd3abeddabe17ba3d899413b8e96c7b6ef1 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9567824.exe
| MD5 | 6fceb82ce3dad9da64cd2ff4d4242a1d |
| SHA1 | bbfcf44036193c98e02ac09a0e6f185ae1e510cc |
| SHA256 | a71ac40c8509a787da333f02a9607ba7bd4c62dbf16769df4bd6eefd4b01b469 |
| SHA512 | ccd8c2650b32eb3c76ef90d43bbaadb4d73776130ac94cd7a6a5f6fc5e43fbab46c9c0fe4e937dbfb5c13b5b08631cd3abeddabe17ba3d899413b8e96c7b6ef1 |
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 20:42
Reported
2023-10-10 21:10
Platform
win10v2004-20230915-en
Max time kernel
145s
Max time network
155s
Command Line
Signatures
Amadey
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe | N/A |
Mystic
RedLine
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3353719.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3597273.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1526405.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6250411.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7787959.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\4f405bcd108372b8b42a0a27e6938da98febc87a9463fa51ebed286b69f19b60.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0795403.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4008 set thread context of 3272 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9567824.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 3904 set thread context of 1632 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4979600.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\4f405bcd108372b8b42a0a27e6938da98febc87a9463fa51ebed286b69f19b60.exe
"C:\Users\Admin\AppData\Local\Temp\4f405bcd108372b8b42a0a27e6938da98febc87a9463fa51ebed286b69f19b60.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0795403.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0795403.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1526405.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1526405.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6250411.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6250411.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7787959.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7787959.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9567824.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9567824.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4008 -ip 4008
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3272 -ip 3272
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 148
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 200
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4979600.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4979600.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3904 -ip 3904
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 584
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3353719.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3353719.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3597273.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3597273.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0841159.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0841159.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 71.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 158.240.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.3.197.209.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.200:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.233.44.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.68.91.77.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 21.236.111.52.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.68.78:80 | 77.91.68.78 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0795403.exe
| MD5 | cff9a270db09630b0e5a52c5a0be5f0c |
| SHA1 | f8da47f571658c211b413a88a174c2aa6c80dd15 |
| SHA256 | 38152b91b9471da19559c0ff6819b0f1021aa47796a687d278b412902ef77301 |
| SHA512 | 8bf7bacbec5bc230d20abf961b9ae37c6d4c7a648a524ee8de65be98bd306cf9e539734601aebfcbafe26fcdff8804585184b739f2e6a494ed53016e4c922087 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0795403.exe
| MD5 | cff9a270db09630b0e5a52c5a0be5f0c |
| SHA1 | f8da47f571658c211b413a88a174c2aa6c80dd15 |
| SHA256 | 38152b91b9471da19559c0ff6819b0f1021aa47796a687d278b412902ef77301 |
| SHA512 | 8bf7bacbec5bc230d20abf961b9ae37c6d4c7a648a524ee8de65be98bd306cf9e539734601aebfcbafe26fcdff8804585184b739f2e6a494ed53016e4c922087 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1526405.exe
| MD5 | 8a6d8092804e13580d5b1230be6ea429 |
| SHA1 | bbddbc17f85f6da94867af292118cb9345523360 |
| SHA256 | 48b995bc819cb201e80c18614bb9f3f50746b581000d98b7cbe15f5ca1f63ddc |
| SHA512 | f6335cb298126a5c740847ad8b658efb44356fe9344dc01c2b3e431b043a5f5529ac51ae47647001c5f8de95ec59d48fbb8d963d710d03f726936ed865072494 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1526405.exe
| MD5 | 8a6d8092804e13580d5b1230be6ea429 |
| SHA1 | bbddbc17f85f6da94867af292118cb9345523360 |
| SHA256 | 48b995bc819cb201e80c18614bb9f3f50746b581000d98b7cbe15f5ca1f63ddc |
| SHA512 | f6335cb298126a5c740847ad8b658efb44356fe9344dc01c2b3e431b043a5f5529ac51ae47647001c5f8de95ec59d48fbb8d963d710d03f726936ed865072494 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6250411.exe
| MD5 | 19e7c77172efa1f049c8737febf5392c |
| SHA1 | 22214e462f09f51d7d510fa3ad99f7c685584fb3 |
| SHA256 | e2be01d99b0a6b9530ee2d93d1ac3e6f9702a68789fa3bf56ea84969ae22fc56 |
| SHA512 | 0b03e4d7f0baa25aba75b5c8fd3395c4977e2a45d88ce09b7eb3f2126761e1933d982a42fe621a8fa9a3fea16eba6ff3daa73bd692265c24cde4ee92a00252c0 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6250411.exe
| MD5 | 19e7c77172efa1f049c8737febf5392c |
| SHA1 | 22214e462f09f51d7d510fa3ad99f7c685584fb3 |
| SHA256 | e2be01d99b0a6b9530ee2d93d1ac3e6f9702a68789fa3bf56ea84969ae22fc56 |
| SHA512 | 0b03e4d7f0baa25aba75b5c8fd3395c4977e2a45d88ce09b7eb3f2126761e1933d982a42fe621a8fa9a3fea16eba6ff3daa73bd692265c24cde4ee92a00252c0 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7787959.exe
| MD5 | ecd67f71e7ab8f63436691739e604baf |
| SHA1 | 6b65563fee1afa40fbbd131db7af7521b54fd5f7 |
| SHA256 | cff0f13d0622f24b9a6d2d80ef7f2b8f0237318aeb8d8fa24b4c2af938a52f4f |
| SHA512 | b0a404a1d02ddfa8b645325858000f4dbd4ccb5f13692b5402fab3fd06a73226da324dbda3c56d363b3b564cafdf9a7459565f7e2ad96b29300bcb73d72feff2 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7787959.exe
| MD5 | ecd67f71e7ab8f63436691739e604baf |
| SHA1 | 6b65563fee1afa40fbbd131db7af7521b54fd5f7 |
| SHA256 | cff0f13d0622f24b9a6d2d80ef7f2b8f0237318aeb8d8fa24b4c2af938a52f4f |
| SHA512 | b0a404a1d02ddfa8b645325858000f4dbd4ccb5f13692b5402fab3fd06a73226da324dbda3c56d363b3b564cafdf9a7459565f7e2ad96b29300bcb73d72feff2 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe
| MD5 | 54422ab3024d4dc2244c37bdd95e66ea |
| SHA1 | f232f6fb96ab795cc98522907f4e29740b36dfa8 |
| SHA256 | c15cfbe7dee5c92962ac951217efc072f7dd5b80dd547cf764ce169a61497095 |
| SHA512 | 5c9ba83cbe8150c077af83b6bbb8d4a5cdff988fd4915be872be968aefb453c2bdfb97cf681903e2ee8c373bd969eb054f8374d0cf60387c1aa44fd791c54f5d |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5505450.exe
| MD5 | 54422ab3024d4dc2244c37bdd95e66ea |
| SHA1 | f232f6fb96ab795cc98522907f4e29740b36dfa8 |
| SHA256 | c15cfbe7dee5c92962ac951217efc072f7dd5b80dd547cf764ce169a61497095 |
| SHA512 | 5c9ba83cbe8150c077af83b6bbb8d4a5cdff988fd4915be872be968aefb453c2bdfb97cf681903e2ee8c373bd969eb054f8374d0cf60387c1aa44fd791c54f5d |
memory/4364-35-0x00000000004F0000-0x00000000004FA000-memory.dmp
memory/4364-36-0x00007FF9C6C90000-0x00007FF9C7751000-memory.dmp
memory/4364-37-0x00007FF9C6C90000-0x00007FF9C7751000-memory.dmp
memory/4364-39-0x00007FF9C6C90000-0x00007FF9C7751000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9567824.exe
| MD5 | 6fceb82ce3dad9da64cd2ff4d4242a1d |
| SHA1 | bbfcf44036193c98e02ac09a0e6f185ae1e510cc |
| SHA256 | a71ac40c8509a787da333f02a9607ba7bd4c62dbf16769df4bd6eefd4b01b469 |
| SHA512 | ccd8c2650b32eb3c76ef90d43bbaadb4d73776130ac94cd7a6a5f6fc5e43fbab46c9c0fe4e937dbfb5c13b5b08631cd3abeddabe17ba3d899413b8e96c7b6ef1 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9567824.exe
| MD5 | 6fceb82ce3dad9da64cd2ff4d4242a1d |
| SHA1 | bbfcf44036193c98e02ac09a0e6f185ae1e510cc |
| SHA256 | a71ac40c8509a787da333f02a9607ba7bd4c62dbf16769df4bd6eefd4b01b469 |
| SHA512 | ccd8c2650b32eb3c76ef90d43bbaadb4d73776130ac94cd7a6a5f6fc5e43fbab46c9c0fe4e937dbfb5c13b5b08631cd3abeddabe17ba3d899413b8e96c7b6ef1 |
memory/3272-43-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3272-44-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3272-45-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3272-47-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4979600.exe
| MD5 | 6c0c515fe93bd753e3ec16dfbb987f10 |
| SHA1 | 5777ba7215d80dea8e284acf88c3cf205ceff31f |
| SHA256 | 83b6de6583dc94acede766374867710c0d59cc2f34bcd4a309e33c15215340d4 |
| SHA512 | 7d8d70855ac14c3076c4418ec8b5674d3fa49d34a4ab8bbbe578938ed8344982a95087875614e3afa53b056579b6359e97a332aed09b44f0f342f0f822ad68f5 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4979600.exe
| MD5 | 6c0c515fe93bd753e3ec16dfbb987f10 |
| SHA1 | 5777ba7215d80dea8e284acf88c3cf205ceff31f |
| SHA256 | 83b6de6583dc94acede766374867710c0d59cc2f34bcd4a309e33c15215340d4 |
| SHA512 | 7d8d70855ac14c3076c4418ec8b5674d3fa49d34a4ab8bbbe578938ed8344982a95087875614e3afa53b056579b6359e97a332aed09b44f0f342f0f822ad68f5 |
memory/1632-51-0x0000000000400000-0x0000000000430000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3353719.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3353719.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
memory/1632-57-0x0000000073570000-0x0000000073D20000-memory.dmp
memory/1632-58-0x0000000005510000-0x0000000005516000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3597273.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u3597273.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0841159.exe
| MD5 | 2dc5219c93731b9628bca77660233f64 |
| SHA1 | 9de0f3f022d1c8f5271d55c8664368d7c35c0742 |
| SHA256 | c70c787c2a4943d706ea19faa38e80aa421aaee3de9eb26a0e39a52d7c2ba409 |
| SHA512 | c3f88587f29373d70a1c7f55dd0408ee2d885617512a7010ab06289d35ec81a07090953e8a3c850bc8f7923bbe2c03ed0d61cbb9a3713b55f4bc6a6dd568011e |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0841159.exe
| MD5 | 2dc5219c93731b9628bca77660233f64 |
| SHA1 | 9de0f3f022d1c8f5271d55c8664368d7c35c0742 |
| SHA256 | c70c787c2a4943d706ea19faa38e80aa421aaee3de9eb26a0e39a52d7c2ba409 |
| SHA512 | c3f88587f29373d70a1c7f55dd0408ee2d885617512a7010ab06289d35ec81a07090953e8a3c850bc8f7923bbe2c03ed0d61cbb9a3713b55f4bc6a6dd568011e |
memory/1632-81-0x0000000005CC0000-0x00000000062D8000-memory.dmp
memory/1632-82-0x00000000057B0000-0x00000000058BA000-memory.dmp
memory/1632-84-0x0000000005560000-0x0000000005572000-memory.dmp
memory/1632-83-0x0000000005590000-0x00000000055A0000-memory.dmp
memory/1632-85-0x00000000056E0000-0x000000000571C000-memory.dmp
memory/1632-86-0x0000000005720000-0x000000000576C000-memory.dmp
memory/1632-87-0x0000000073570000-0x0000000073D20000-memory.dmp
memory/1632-88-0x0000000005590000-0x00000000055A0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
| MD5 | 6d5040418450624fef735b49ec6bffe9 |
| SHA1 | 5fff6a1a620a5c4522aead8dbd0a5a52570e8773 |
| SHA256 | dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3 |
| SHA512 | bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
| MD5 | ec41f740797d2253dc1902e71941bbdb |
| SHA1 | 407b75f07cb205fee94c4c6261641bd40c2c28e9 |
| SHA256 | 47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520 |
| SHA512 | e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33 |
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
| MD5 | a427281ec99595c2a977a70e0009a30c |
| SHA1 | c937c5d14127921f068a081bb3e8f450c9966852 |
| SHA256 | 40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3 |
| SHA512 | 2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bd59a6b3207f99fc3435baf3c22bc4e |
| SHA1 | ae90587beed289f177f4143a8380ba27109d0a6f |
| SHA256 | 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236 |
| SHA512 | ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324 |